TI-2023-15958 Aliases CVE-2023-32682 GHSA-26c5-ppr8-f33p

Improper checks for deactivated users during login in synapse

LOW 26CWE-287Published 2023-06-06 · Updated 2025-02-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the `jwt_config.enabled` configuration setting. 2. The local password database is enabled via the `password_config.enabled` and `password_config.localdb_enabled` configuration settings *and* a user's password is updated via an admin API after a user is deactivated. Note that the local password database is enabled by default, but it is uncommon to set a user's password after they've been deactivated. Installations that are configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected. If not using JSON Web Tokens, ensure that deactivated users do not have a password set. This issue has been addressed in version 1.85.0. Users are advised to upgrade.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00752 55th percentileScored 2026-11-07

Fix Fixed synapse (matrix-org): 1.85.0matrix-synapse (PyPI): 1.85.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
matrix-org	synapse	before 1.85.0	1.85.0	Patch available	CNA
—	matrix-synapse (PyPI)	before 1.85.0	1.85.0	Patch available	GHSA-26c5-ppr8-f33p

synapse Vendormatrix-org Affected before 1.85.0 Fixed in 1.85.0 Patch available CNA
matrix-synapse (PyPI) Vendor— Affected before 1.85.0 Fixed in 1.85.0 Patch available GHSA-26c5-ppr8-f33p

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:matrix:synapse::::::::	before 1.85.0	Vulnerable	matrix-org

cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* Versions before 1.85.0 Vulnerable ·matrix-org

Remediation

Fix · CNA synapse (matrix-org) Fixed in 1.85.0
Fix · GHSA-26c5-ppr8-f33p matrix-synapse (PyPI) Fixed in 1.85.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2023-32682
2026-10-03 Alias added: GHSA-26c5-ppr8-f33p

References

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2023-32682

Other 9

TI-2023-15617 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVSS 3.1MEDIUM 5.0
TI-2024-35327 Synapse allows a a malformed invite to break the invitee's `/sync` CVSS 4.0HIGH 8.7
TI-2019-13571 Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. CVSS 3.1CRITICAL 9.8
TI-2024-36056 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders CVSS 4.0HIGH 8.2
TI-2024-35318 Synapse allows unsupported content types to lead to memory exhaustion CVSS 4.0HIGH 8.2
TI-2018-11846 Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have… CVSS 3.0HIGH 8.8

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences